Gafgyt

Gafgyt, also known as Bashlite, is a form of malware that infects Linux architecture operating systems to launch Distributed Denial of Service (DDoS) attacks. The malware infiltrates systems through suspicious downloads, emails, or websites, and once inside, it can steal personal information, disrupt operations, or even hold data hostage for ransom. A variant of the Gafgyt bot exploits vulnerabilities in systems to expand DDoS attacks on Linux-based systems. By downloading and executing malicious scripts, this Gafgyt variant establishes connections with command-and-control servers, awaiting instructions to launch coordinated attacks on targeted victims. Researchers from Unit 42, Palo Alto Networks, and Fortinet have observed multiple attacks over the past month focused on exploiting system vulnerabilities. These include attacks from popular Linux botnets such as Mirai and Gafgyt which usually generate random IP addresses as scanning destinations. In addition to these, other botnets including Moobot, Miori, the Golang-based agent "AGoent," a Gafgyt variant, and an unnamed variant of the infamous Mirai botnet have been identified as part of these attack campaigns. Threat actors are taking advantage of unpatched devices to dispatch various botnets — including Moobot, Miori, AGoent, a Gafgyt variant, and variants of the infamous Mirai botnet — that can compromise the devices for DDoS and further nefarious activity. Researchers found that the notorious Mirai and Gafgyt malware families, known for turning devices into botnets, drove the majority of attacks, constituting 66% of blocked payloads. Other commonly used malwares include ShellBot, Tsunami, ChinaZ DDoS Bot, XMRig CoinMiner, and Gafgyt.